Spring Security Patterns
summary
A demo Spring Boot app gets secure-by-default after adding spring-boot-starter-security: endpoints switch from 200 to 401 and a random password is generated. The app shows a deployable pattern set: replace UserDetailsService bean (last-one-wins), inspect the filter chain and fail-fast CSRF filter, use SecurityContextHolder threadlocal then method parameter injection for Authentication, flip to JWT resource-server and compose a custom GrantedAuthoritiesConverter (final classes force delegation), test that pilot token can move the craft while ria cannot, then move authorization rules into a SecurityFilterChain bean.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:58Spring Security by Default
- 3:37Application of Least Privilege
- 7:13Replacing Configuration
- 12:10Authentication
- 15:03dependency injection
- 20:14granted authorities
related talks
54mSpring Security Patterns
45mSpring Security: The Good Parts
52mSpring Security for N00bz: A quick introduction for the terminally insecure
52mArchitecture Deep Dive in Spring Security
01h 31mGetting Started with Spring Security 3.1
46mImplementing Microservices Security Patterns & Protocols with Spring Security
51mSecuring SPAs with Spring
51mEverything new in Spring Security 6 baked with a Spring Boot 3 recipe